JD Key Consulting Logo
HB4377

Regular Session

Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.

Critical
Medium Cost
Effective:2025-06-20
HB4377
Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.
Critical Urgency
Unanimous Passage
House Vote131 - 0
YEA
100% in favor131 voting
Senate Vote31 - 0
YEA
100% in favor31 voting
Cost Impact
Medium
Effective
2025-06-20
Enforcing Agencies
DFPS
Primary Author: Rep. Denise Villalobos
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: September 1, 2025
  • Compliance Deadline: January 1, 2026 (Hard deadline for the destruction of all historical samples and deletion of data).
  • Agency Rulemaking: DFPS is expected to issue guidance between September and December 2025 regarding verification standards for destruction and the specific definition of "promptly."

Immediate Action Plan

  • 1. Conduct Immediate Inventory: Launch a full audit to locate all physical DFPS-related biological samples and digital genetic datasets currently in your possession.
  • 2. Segregate Data: Configure IT systems to separate the "Result" (allowable retention) from the "Genetic Information" (mandatory deletion).
  • 3. Amend Vendor Contracts: Send notices to all downstream storage and IT vendors regarding the new statutory destruction requirement.
  • 4. Execute Historical Purge: Begin the systematic destruction of the backlog now to ensure completion before the January 1, 2026 hard deadline.
  • 5. Update Privacy Policies: Revise internal data retention policies to reflect that DFPS genetic data is now an exception to standard retention schedules.

Operational Changes Required

Contracts

  • DFPS Master Service Agreements: Expect immediate amendments from DFPS to incorporate mandatory destruction clauses.
  • Subcontractor Flow-Down: You must amend agreements with third-party storage facilities and IT cloud providers. You remain liable for samples held by your subcontractors; ensure their contracts explicitly require destruction upon your command.

Hiring/Training

  • IT & Data Management: IT teams must be trained to segregate "Genetic Information" (raw sequencing data) from "Test Results" (final reports). The former must be deleted; the latter may be retained.
  • Lab Operations: Staff must transition from a "store and archive" workflow to a "test and destroy" workflow. Implement a "kill switch" protocol to destroy physical samples immediately upon report finalization.

Reporting & Record-Keeping

  • Certificates of Destruction (COD): Implement auditable logs for physical sample destruction (date, time, method, officer).
  • Data Deletion Logs: IT systems must generate automated logs proving the permanent erasure of raw genetic data fields from servers and backups.
  • Audit Defense: Prepare for annual DFPS compliance attestations confirming no prohibited genetic material remains in your custody.

Fees & Costs

  • Retrospective Cleanup Costs: Budget immediately for the labor and disposal costs associated with identifying and destroying years of historical samples before January 1, 2026.
  • Revenue Impact: If your business model includes fees for long-term sample storage, this revenue stream is now illegal for DFPS cases.

Strategic Ambiguities & Considerations

  • Definition of "Promptly": The statute requires destruction "promptly" after the test purpose is accomplished but does not define a specific window (e.g., 24 hours vs. 30 days). Guidance: Adopt a policy of destruction within 30 days of reporting until rulemaking clarifies.
  • Backup Tapes: The law requires deletion of genetic information but does not explicitly address disaster recovery backups, which are difficult to scrub selectively. Guidance: Treat backup tapes as in-scope and consult IT legal counsel regarding "put beyond use" standards.
  • Verification Standards: It is currently unclear if DFPS will require video evidence of physical destruction or specific digital forensic standards (e.g., NIST guidelines) for data wiping.

Need Help Understanding Implementation?

Our government affairs experts can walk you through this bill's specific impact on your operations.

Schedule Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Mar 11, 2025
Passed House
May 10, 2025
Passed Senate
May 25, 2025
Signed
Jun 20, 2025
TopicsFamilyFamily--child ProtectionHealthHealth--generalDnaPaternityFamily & Protective Services, Department of
03

House Authors

Rep. Denise VillalobosRepublican · Primary Author
Joint Authors

Senate Sponsor

Sen. Bob HallRepublican · Primary Sponsor

Bill Text(with markup)

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Rep. Denise Villalobos

View all bills by Rep. Denise Villalobos

Related by Topic

View more Family legislation
Quick Reference

Frequently Asked Questions

Common questions about HB4377

Q

What does Texas HB4377 do?

HB4377 mandates the retroactive destruction of all genetic material and deletion of genetic information collected under contract with the Department of Family and Protective Services (DFPS) for paternity testing. This legislation strictly impacts laboratories, data storage vendors, and diagnostic providers, requiring a complete purge of historical biological samples and raw genetic data by January 1, 2026, while permitting the retention of the final paternity result. Implementation Timeline Effective Date: September 1, 2025 Compliance Deadline: January 1, 2026 (Hard deadline for the destruction of all historical samples and deletion of data).

Q

Who authored HB4377?

HB4377 was authored by Texas Representative Denise Villalobos during the Regular Session.

Q

When was HB4377 signed into law?

HB4377 was signed into law by Governor Greg Abbott on June 20, 2025.

Q

Which agencies enforce HB4377?

HB4377 is enforced by Department of Family and Protective Services (DFPS).

Q

How urgent is compliance with HB4377?

The compliance urgency for HB4377 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.

Q

What is the cost impact of HB4377?

The cost impact of HB4377 is estimated as "medium". This may vary based on industry and implementation requirements.

Q

What topics does HB4377 address?

HB4377 addresses topics including family, family--child protection, health, health--general and dna.

Legislative data provided by LegiScanLast updated: November 25, 2025

Need Strategic Guidance on This Bill?

Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.